CVE-2024-56321

GoCD is a continuous deliver server. GoCD versions 18.9.0 through 24.4.0 inclusive can allow GoCD admins to abuse the backup configuration "post-backup script" feature to potentially execute arbitrary scripts on the hosting server or container as GoCD's user, rather than pre-configured scripts. I...

CVE-2024-56321: Improper Input Validation

GoCD is a continuous deliver server. GoCD versions 18.9.0 through 24.4.0 inclusive can allow GoCD admins to abuse the backup configuration "post-backup script" feature to potentially execute arbitrary scripts on the hosting server or container as GoCD's user, rather than pre-configured scripts. I...

PT-2021-16854

Name of the Vulnerable Software and Affected Versions GoCD versions 19.6.0 through 21.1.0 Description The issue is related to Cross-Site Request Forgery CSRF due to missing protection at the "/go/api/config/backup" endpoint. An attacker can trick a victim into clicking on a malicious link,...